phorphiex | 6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078

General

Target

629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe
Size

32KB
MD5

629fba91ff579f1e890e489a028d7eb1
SHA1

c6871d6ce30d012e79412761bd6c0c75be37d084
SHA256

6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078
SHA512

5e5786f841a6581879c929374e848d55525ad73e136fbb8690c5d89587c431ef60c2f666203bb216cd8271fc27274119025e315156cb7b24cf1bb4d59f611183
SSDEEP

384:UOFl9ooXxUDs/uG67GRtA2ZmQF1szUQIENIay2vWpQVGq71BV7ISlDqzhr1zFz:U0l9GDs/uGTNnggERZBV7VWzFDz

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://worm.ws/

http://seuufhehfueugheh.ws/

http://feuhdeuhduhuehdh.ws/

http://feauhueudughuurh.ws/

http://fheuhdwdzwgzdggh.ws/

http://faugzeazdezgzgfh.ws/

http://wduufbaueeubffgh.ws/

http://okdoekeoehghaoeh.ws/

http://efuheruhdehduhgh.ws/

http://eafueudzefverrgh.ws/

http://deauduafzgezzfgh.ws/

http://gaueudbuwdbuguuh.ws/

http://efeuafubeubaefuh.ws/

http://eafuebdbedbedggh.ws/

http://wdkowdohwodhfhfh.ws/

http://efaeduvedvzfufuh.ws/

http://edhuaudhuedugufh.ws/

http://eaffuebudbeudbbh.ws/

http://seuufhehfueughet.to/

http://feuhdeuhduhuehdt.to/

Wallets

19KXPyopGnfZ1dGjLpPPqbo7Jpqki9A9mW

3NShfYPbqkPmPkXEgJ1SGUYgSjxt1Robhs

bc1qf4awd7k76q0tks25ax7q48wmsvslvy64er6n6w

qqe5entlms8sudv7a60dnu5gpttlukmspuk5zxsahe

XjgwEqD6iFf5pHxqSzj4tm8mgs7TsS2kEw

DHvsojZJPxoYYwtVw7voSuv2ga5LGoQpG1

0xA557fe5c21325eB8f6C7d5f2004Db988c8C8D8B5

LYr5qEmeAcpv7JeCEE2HfGPV74DZLYHeT2

42TCgxVg6itTv4v8dvyCQEETmHL5N6i8a8rvcqGWb2QtWUrBpq3SdDnZbhpcg2S3UbNG98Woi6KEH7dWtpnEHQrDEzQbENy

rDs45wyGR5E6sHajNGHeNqvjvXaCJrJ22j

TY59jfEA2xQBk4R8AAJG3tBGQybMm1aSba

t1NBaHW8QgULABaASvzNALmxem8EutnxLtr

GDR62FPKRATKXTLSR3JDCVGDAVF6YC5RVZ2RQ55SNW6C2UWND3KGUHPW

P44ZCLTNESUGZESVC3QMK6LSFY7LYW3N23FKX56UMCEXK6NZBG3BUNPDWI

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Phorphiex payload 1 IoCs

Processes:

resource	yara_rule
C:\150421981512746\svchost.exe	family_phorphiex

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	svchost.exe

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

2404 svchost.exe

pid	process
2404	svchost.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\150421981512746\\svchost.exe"	629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\150421981512746\\svchost.exe"	629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe

description	pid	process	target process
PID 2916 wrote to memory of 2404	2916	629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe	svchost.exe
PID 2916 wrote to memory of 2404	2916	629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe	svchost.exe
PID 2916 wrote to memory of 2404	2916	629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\629fba91ff579f1e890e489a028d7eb1_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2916

C:\150421981512746\svchost.exe
C:\150421981512746\svchost.exe
2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
PID:2404

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\150421981512746\svchost.exe
Filesize
32KB

MD5
629fba91ff579f1e890e489a028d7eb1

SHA1
c6871d6ce30d012e79412761bd6c0c75be37d084

SHA256
6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078

SHA512
5e5786f841a6581879c929374e848d55525ad73e136fbb8690c5d89587c431ef60c2f666203bb216cd8271fc27274119025e315156cb7b24cf1bb4d59f611183

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads